Privacy policy

• No password, no newsletter, no advertising cookies.
• We count visits and a few actions without cookies, on our own server, without your address or anything that identifies you.
• A free preview runs against public geodata and Google Maps; we store nothing about it on our servers.
• A purchase creates an account: your email address, what you bought and the report itself, because that is what delivers the report.
• Your recent searches and the reports you bought are remembered in your own browser, not on our servers.

When you open a page, our host receives the technical data every web request carries (IP address, browser type, time and the page requested) and keeps it in server logs for a short period to run the service securely and diagnose faults. Legal basis: our legitimate interest in a working, secure website (Art. 6(1)(f) GDPR). Logs are deleted after 14 days.

Hosting: Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Deutschland. Data stays within the EU.

To learn which pages help and where visitors give up, we count page views and a few actions, such as opening a preview, tapping a locked section or starting a checkout, with Umami, which runs on our own server. It sets no cookies and stores nothing on your device. From your IP address and browser it derives a visitor identifier that changes every month, and keeps that identifier, your approximate location (country, region, city), browser, device type, screen size and the website that linked to us. It never keeps the IP address itself.

Before anything is recorded, addresses, report links and sign-in codes are removed from it: the most precise place we record is a municipality. Nothing is passed on to anyone. If your browser sends "Do Not Track", nothing is counted.

Legal basis: our legitimate interest in understanding and improving the service (Art. 6(1)(f) GDPR). The statistics are deleted after 25 months.

The map and the address search are provided by Google Maps Platform (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland). When the map loads, and while you type an address, your browser sends the request to Google, including your IP address and the text you type. Our server also queries Google for places, distances and routes around the address you chose. Google may transfer this data to the USA; Google LLC is certified under the EU–US Data Privacy Framework.

Legal basis: the map and search are the service you asked for (Art. 6(1)(b) GDPR) and our legitimate interest in providing them with the best available mapping data (Art. 6(1)(f)). Google's own processing is described at policies.google.com/privacy.

Municipality descriptions and photos come from Wikidata, Wikipedia and Wikimedia Commons; our server fetches them, so nothing about you reaches the Wikimedia Foundation.

To sell you a report we process: the email address you enter, the product and price, the addresses you unlock, the payment status and reference the payment provider reports back, and the report content itself. Legal basis: performing the contract with you (Art. 6(1)(b) GDPR) and our legal obligations to keep accounting records (Art. 6(1)(c)).

Payment is taken by [Payment provider, e.g. Stripe Payments Europe Ltd., Dublin, Irland]. Your card or bank details go directly to them; we never see them and only receive confirmation that a payment succeeded, failed or was refunded.

A receipt is sent to your email address through [Email provider, e.g. Postmark (ActiveCampaign LLC, USA)] when you buy unlocks, and a report link each time you use one on an address; so is a one-time sign-in code whenever you ask to sign in. We also send one reminder shortly before a report expires. There is no newsletter and nothing else is sent.

A report stays interactive for 30 days and can be reactivated afterwards. Report content is deleted once it can no longer be reactivated or on your request; order records are kept for seven years as Austrian tax law (§132 BAO) requires.

If you create a share link, anyone holding it can read that report. Share links are excluded from search engines. We do not otherwise make reports available to anyone.

We note each time a report is opened or its PDF downloaded, and whether by its owner or through a link. We use an identifier derived from the IP address that differs for each buyer's reports, so we can count readers without recognising them elsewhere. These records are deleted with the report.

We set only cookies that are strictly necessary, which need no consent under §165(3) of the Austrian Telecommunications Act (TKG 2021):

• zugum_language: the language you picked, for one year.
• The owner session: set when you sign in with your email, so this browser can edit what you bought. It lapses after 30 days without use, after 180 days at the latest, or when you sign out (on this browser or on all of them).
• The sign-in cookie: set when you ask for a sign-in code, so the code works only in this browser. It lapses after 15 minutes.

Your browser's local storage keeps your recent searches, the reports you bought and your personalization settings, so they survive a page reload. This data never leaves your device; clearing site data removes it.

Scores are computed about addresses, never about you. We build no profile of you and make no automated decision with legal effect on you.

You may ask for access to your data, have it corrected or deleted, restrict or object to its processing, and receive it in a portable format (Art. 15–21 GDPR). Write to hello@zugum.example; naming the email address you bought with lets us find your data. If you believe we process your data unlawfully, you can complain to the Austrian Data Protection Authority: Datenschutzbehörde, Barichgasse 40–42, 1030 Wien, dsb@dsb.gv.at.

We update this page when the service changes. The date at the top says when; the current version always applies.